What eBPF is — running programs in the kernel safely

eBPF — A Safe Programmable Kernel

Extended Berkeley Packet Filter (eBPF) is one of the most significant additions to Linux in the past decade. Originally a tiny VM in the kernel for tcpdump-style packet filtering, eBPF has evolved into a general-purpose execution environment where user-supplied programs run safely inside the kernel. Programs are written typically in C, compiled to BPF bytecode, loaded via bpf() syscall, verified by the kernel for safety properties (terminates, no infinite loops, no out-of-bounds memory access, no unprivileged operations), and then attached to hook points throughout the kernel — function…